DPDP Act 2023 for Marketing Agencies in India: What Changes

Most DPDP explainers are written for banks, hospitals and e-commerce companies. Nobody has written one for the twelve-person agency in Delhi NCR that runs lead ads for a real-estate developer, keeps the developer's Instagram password in a Google Sheet, and downloads a CSV of 1,400 enquiries every Monday. That agency is squarely inside the Act, and its exposure is different from the client's in ways that matter for the contract, the tools and the offboarding checklist. This post is the version I wish someone had handed me. It is not legal advice; it is an operator's reading of the Act and the Rules, with links to the primary text so you can check it.

Who are you under the Act: fiduciary or processor?

The Act uses two roles. The data fiduciary is whoever decides the purpose and means of processing. The data processor is whoever processes personal data on the fiduciary's behalf. The data principal is the person the data is about. Personal data is any data about an individual who is identifiable by or in relation to it, which covers a name, a phone number, an email, a face in a photograph and the mobile number attached to a WhatsApp enquiry.

An agency wears both hats, and the trick is knowing which one you have on:

The distinction is not academic. As a processor the Act does not put direct statutory duties on you; it puts them on the client and makes the client answer for you. As a fiduciary for your own data, the duties are yours directly. Most agencies I know have never thought about the second column at all.

What does the Act actually say about the client-agency relationship?

Three sub-sections of Section 8 do most of the work. I am quoting them because the paraphrases circulating online soften them.

• Section 8(1): the fiduciary is responsible for compliance "irrespective of any agreement to the contrary" in respect of any processing "undertaken by it or on its behalf by a Data Processor". Your client cannot contract out of liability for what you do. That is why sophisticated clients have started sending data-processing addendums.
• Section 8(2): a fiduciary may engage a processor "only under a valid contract". If your retainer does not mention data, your client is already in breach of this sub-section the day the obligations take effect. Our retainer agreement post now needs a data clause, and I say what it should contain below.
• Section 8(5): the fiduciary must protect personal data "including in respect of any processing undertaken by it or on its behalf by a Data Processor" with reasonable security safeguards. Your security is their security.
• Section 8(7)(b): the fiduciary must "cause its Data Processor to erase any personal data" once the purpose is served or consent is withdrawn. Read: when the client leaves, they are obliged to make you delete their data, and you should be ready to prove you did.

On top of the Act, the Rules add the operational detail. Rule 3 requires the consent notice to be "presented and be understandable independently of any other information", with an itemised description of the personal data and the specific purpose. A consent line buried in a landing page's terms does not qualify. Rule 7 sets the breach clock: affected individuals must be told without delay, and the Data Protection Board gets an initial intimation without delay plus a detailed report within 72 hours; King Stubb & Kasiva walk through the two stages. EY's guide to engaging processors lists the contract terms fiduciaries are now asking for: scope and purpose, audit rights, sub-processor authorisation, confidentiality, breach assistance and deletion.

When does this actually start?

The Act was passed in August 2023 and then sat without rules for over two years. The DPDP Rules, 2025 were notified on 13 November 2025 with an 18-month phase-in, which Sansa Legal lays out as three phases:

• 13 November 2025: the Data Protection Board of India is constituted and can function.
• 13 November 2026: the consent-manager framework goes live. Consent managers are registered Indian companies through which individuals can manage permissions across many fiduciaries.
• 13 May 2027: the core obligations take effect: notice and consent, security safeguards, breach reporting, retention and erasure, and the rights of individuals.

Writing this in September 2026, that is eight months. Enterprise clients are not waiting; the addendums are already arriving. The point of moving now is not fear of the Board on day one. It is that the agency which can answer a client's data questionnaire in an afternoon wins the retainer over the one that cannot.

Where does an agency actually touch personal data?

When I audited our own operation, the list was longer than I expected. Go through yours honestly:

1. Lead forms. Meta lead ads, website forms, landing pages, WhatsApp click-to-chat. Every enquiry is a name and a phone number, collected for a purpose the person was told, or was not.
2. WhatsApp broadcast lists. The client's customers, exported to a phone that belongs to an account manager, used for festive offers. This is the single most common unconsented processing I see in Indian agencies.
3. Custom and lookalike audiences. Uploading a customer list to Meta or Google is processing, and it is disclosure to another entity. The customer needs to have been told marketing was a purpose.
4. Contest and giveaway entrants. Comments, DMs and Google Forms with names and numbers, kept forever "for the next one".
5. Faces. Customers, patients, students, gym members, wedding guests. We covered the specific case in the wedding-industry post; the principle is that an identifiable photo is personal data and a written usage clause beats a verbal one.
6. Influencer data. Creator contact details, PAN numbers for payment, bank details. The ASCI post covers disclosure; this is the other half.
7. Client credentials. Instagram, Facebook, Google Business Profile and ad-account logins. Not personal data in the ordinary sense, but the key to all of the above, and squarely a "reasonable security safeguard" question under Section 8(5).
8. Your own leads and staff. The enquiry form on your agency site, your team's Aadhaar copies in a Drive folder, your client contacts in a CRM. You are the fiduciary here, and Rule 3 applies to your own form.

The password problem is now a compliance problem

For years the argument against sharing client passwords was operational: accounts get locked, people leave, two-factor codes go to the wrong phone. The password-sharing post made that case. The Act adds a second argument. A shared password in a WhatsApp group is not a reasonable security safeguard by any reading, and when it leads to a breach, Section 8(5) puts the failure on the client while Section 8(1) stops the client from disowning it. The client's lawyer will then read your contract to see whether it lets them recover from you. Assume it does.

The fix is the same one that was already correct: the client stays admin of their own Meta assets, the agency is granted access through Business Manager or through a tool that uses Meta's official API, each teammate has their own login with a role, and access is removed the day a person or a client leaves. That is also what "technical and organisational measures" in Section 8(4) looks like at agency scale.

What should an agency actually do before May 2027?

Six things, in the order I would do them. None needs a lawyer for the first pass, though the contract clause deserves one before you standardise it.

1. Add a data-processing clause to the retainer. What data you receive, for what purpose, that you process only on the client's instructions, the security measures you keep, that you will notify the client of any breach without delay so they can meet the 72-hour report, which sub-processors you use (your scheduling tool, your CRM, your cloud drive), and that you will delete or return everything within a fixed number of days of the retainer ending. Enterprise clients will send their own; having yours ready keeps the negotiation short.
2. Fix the lead form. Every form you build for a client gets a standalone consent line that says what will be collected, why, and how to withdraw, in plain language and not inside a terms link. If the same lead will also be added to a WhatsApp list, say so. This is Rule 3, and it is also better marketing: people who opted in convert.
3. Keep a processing register. One sheet per client: which data, from where, stored where, who on the team has access, which tools touch it, when it gets deleted. It takes an hour per client and answers ninety percent of any questionnaire.
4. Build the offboarding step. Our onboarding checklist has a mirror image now: when a client leaves, revoke access, delete lead exports and audience files, remove them from any group, and send a one-line confirmation that you have done so. Section 8(7)(b) obliges the client to make you do this; do it before they ask.
5. Write a one-page breach playbook. Who on the team is told, who calls the client, what the client needs from you for their Board report. When a laptop is stolen or a shared drive is exposed, nobody should be working it out on the day.
6. Read your tools' terms. A scheduling tool, a CRM and a cloud drive are your sub-processors. Know where they store data, whether they will tell you about a breach, and whether you can delete a client's data on request. This is a reasonable question to ask any vendor, including us.

What are the penalties, correctly stated?

You will read "₹250 crore" attached to every DPDP sentence on the internet. The Schedule to the Act is more specific, and quoting it correctly is a small way of showing a client you have actually read the law:

These are ceilings, imposed by the Board on the fiduciary after considering the nature, gravity and duration of the breach. No Indian agency is going to be fined ₹250 crore. What can realistically happen is that a client is investigated, the investigation finds the breach originated in the agency's shared spreadsheet, and the client invokes the indemnity in the contract you signed without reading. The commercial risk is losing the client and the fee, not the headline number.

One last thought. The Act formalises something that was already the deal: the client trusts you with their customers. Most of the checklist above is what a well-run agency did anyway, written down. The tools that make it easy, such as role-based logins, per-client workspaces, an audit trail and a clean way to remove a client, are the same ones that make the agency run better. That is the argument behind the agency management software page, and it was true before the Board existed.

Frequently asked questions